Performance Troubleshooting

Chapter 1 introduced Task Manager and Resource Monitor as general-purpose tools; Chapter 2 added Event Viewer's own historical dimension. This chapter puts all three to work specifically on performance problems, adds a fourth tool built for logging performance over time rather than watching it live, and gives an honest comparison against Linux Performance Tuning's own, very differently organized toolset.

Task Manager's Performance Tab — Reading It Correctly

Four resource graphs, each measuring something genuinely different: CPU (utilization percentage, speed, process/thread/handle counts), Memory (in use vs. available, committed, cached), Disk (active time percentage and read/write throughput), and Network (send/receive throughput per adapter).

Resource Monitor's Memory Tab — Hard Faults, Not Just Percentage Used

High memory usage alone doesn't necessarily mean a machine is struggling — Windows deliberately caches aggressively, and "available" memory being low is often just unused cache ready to be reclaimed instantly. The more reliable indicator of real memory pressure is Hard Faults/sec, visible in Resource Monitor's Memory tab: a hard fault means data had to be read back from disk because it had been paged out, a genuinely expensive operation and a much more direct sign of insufficient memory than the raw usage percentage alone.

Performance Monitor — Logging Over Time, Not Just Watching Live

Task Manager and Resource Monitor both show a live snapshot — neither one is built to answer "what was happening at 3 AM last night when this machine locked up." Performance Monitor (perfmon.exe) solves that with Data Collector Sets — a defined group of performance counters logged to disk continuously or on a schedule, reviewable afterward regardless of whether anyone was watching when the problem actually occurred.

A Worked Example — Finding a Real Resource Hog

Task Manager's Performance tab shows Disk at a sustained 100% active time, but the throughput figure alongside it is only a few hundred KB/s — the exact misleading pattern this chapter's own warn-box named. Opening Resource Monitor's Disk tab and sorting by IOPS (rather than raw throughput) reveals one process issuing a huge number of tiny read requests. Cross-referencing its PID against Task Manager's Details tab (Chapter 1) identifies the exact application; checking Event Viewer (Chapter 2) around the same timestamp turns up a warning from that same app about a corrupted local cache file it's been repeatedly trying, and failing, to read.

An Honest Contrast With Linux Performance Tuning

Linux Performance Tuning covers a CLI-first toolset — top/htop, iostat, vmstat — reflecting Linux's own general command-line-centric culture. Windows's equivalent tools are GUI-first by default, though real CLI/scriptable equivalents do exist: typeperf and PowerShell's own Get-Counter cmdlet (Chapter 10 of Windows 11 Fundamentals) can capture the exact same underlying performance counters Performance Monitor's GUI displays, entirely from a script — genuinely useful for automated monitoring, just not the default first tool most Windows users or documentation reach for.

Hands-On Exercises